[dependabot]

Bumps org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.1 to 3.2.0.

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.2.0 released!

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

• Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
• Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
• MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
• WebAsyncTask return types are unwrapped (#3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​arimu1, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​gwr0-0, @​Tework123, @​awinishere.

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.2.0] - 2026-10-24

Added

• #3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
• #3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
• #3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
• #3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
• #3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
• #3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
• #3361 – The amount and currency properties of MonetaryAmount are now marked as required
• #3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
• #3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
• Upgrade spring-boot to version 4.1.2
• Upgrade swagger-ui to version 5.34.0
• Upgrade spring-cloud-function to version 5.0.5
• Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

• #3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
• #3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
• #3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
• #3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
• #3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
• #3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
• #3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
• #3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
• #3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds

Commits

• 6b79ced [maven-release-plugin] prepare release v3.2.0
• 689fc13 Describe the nullable property customizer flags in the configuration metadata
• 7a1b506 Correct the LocalTime format in the changelog entry of gh-3351
• 96245a2 Upgrade Scalar to 0.6.83
• c494456 Build against the GA versions of the optional Spring dependencies
• 2d4595f Restore the changelog entries lost in the unreleased fixed section
• dd807bd Upgrade swagger-ui to version 5.34.0
• e649960 Upgrade spring-boot to 4.1.2
• b170ca8 Use the Jackson 2 managed by Spring Boot
• ae52fe7 Register the MCP tools with a McpStatelessSyncServer
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
maven/org.springdoc:springdoc-openapi-starter-webmvc-ui	3.2.0	Unknown	Unknown

Scanned Files

• pom.xml